Setting Up Ghidra & Importing Binaries

Setting Up Ghidra & Importing Binaries

Why Ghidra for Malware Analysis?

Ghidra is the NSA-released open-source Software Reverse Engineering (SRE) framework. It provides a full-featured disassembler, decompiler, and scripting engine that rivals commercial tools like IDA Pro at zero cost. For malware analysts, Ghidra enables static code analysis of suspicious binaries without executing them, which is the foundation of safe, deep reverse engineering.

Ghidra supports:

• x86, x64, ARM, MIPS, and many other processor architectures
• PE, ELF, Mach-O, raw binary, and dozens of other formats
• Decompilation to C-like pseudocode for faster comprehension
• Annotation and collaboration through shared projects
• Scripting in Java and Python (via Jython) for automation

Analyst Tip: Ghidra is not a sandbox or a debugger. It performs purely static analysis -- reading the bytes on disk without executing the binary. Pair it with a dynamic analysis environment (REMnux, FlareVM) for a complete workflow.

Installation and First Launch

Prerequisites

Installation Steps

1. Download the latest release from ghidra-sre.org
2. Extract the ZIP archive to a location of your choice (no installer required)
3. Launch Ghidra:
   • Windows: Double-click ghidraRun.bat
   • Linux/macOS: Run ./ghidraRun from a terminal
4. On first launch, Ghidra may prompt you to specify your JDK path -- point it to the bin directory of your JDK installation

Common Pitfall: If Ghidra fails to launch, verify that java --version reports JDK 17+. A frequent mistake is having an older JRE on the system PATH instead of the required JDK.

Creating a Project

Ghidra organizes all analysis work into projects. A single project can hold many binaries and preserves all your annotations, renamed functions, comments, and bookmarks.

Steps to Create a New Project

1. From the Ghidra Project Window, go to File > New Project
2. Choose Non-Shared Project (local analysis -- the standard choice)
3. Select a project directory and give it a descriptive name (e.g., Case_2024_Ransomware_Triage)
4. Click Finish

The project window now appears, showing a folder-like view where imported binaries will live.

Project Organization Best Practices

Importing a Malware Binary

Import Workflow

1. In the project window, go to File > Import File (or press I)
2. Select the malware sample from disk
3. Ghidra displays the Import Results dialog showing:
   • Format: PE (Portable Executable), ELF, Mach-O, or Raw
   • Language: x86, x64, ARM, etc., with compiler specification
   • Warnings: Any issues detected during import parsing
4. Review the detected format and language -- Ghidra auto-detects these correctly for standard PE and ELF binaries
5. Click OK to add the binary to the project

Import Options Reference

What Happens During Import

Ghidra parses the binary's header structures to identify:

• Sections (.text, .data, .rdata, .rsrc)
• Import Address Table (IAT) -- DLLs and functions the binary calls
• Export table -- functions the binary exposes (relevant for DLLs)
• Resources -- embedded icons, strings, manifests, or payloads
• Entry point address -- where execution begins

Auto-Analysis: The Critical First Step

When you double-click an imported binary to open it in the CodeBrowser, Ghidra prompts:

"Would you like to analyze this program?"

Always click "Yes" to run auto-analysis. This is where Ghidra transforms raw bytes into navigable disassembly and decompiled code.

Key Analyzers to Understand

Analysis Configuration Tips

• Accept the defaults for standard PE analysis -- they cover 95% of cases
• For 64-bit binaries, ensure the language is set to x86:LE:64:default
• Analysis time varies: small binaries finish in seconds, large ones (5+ MB) may take several minutes
• Watch the progress bar at the bottom right of CodeBrowser -- do not start annotating until analysis completes

Analyst Tip: If the decompiler output looks poor after auto-analysis, try running Analysis > One Shot > Decompiler Parameter ID again. Occasionally a second pass improves results after the first pass discovers more functions.

Verifying Your Setup

After auto-analysis completes, verify that Ghidra processed the binary correctly by checking these four windows:

Quick Verification Checklist

• Symbol Tree > Imports shows at least one DLL with imported functions
• Clicking a function in the Symbol Tree navigates the Listing view to that function
• The Decompile window shows pseudocode (not an error message)
• The Functions list (Symbol Tree > Functions) contains discovered functions
• The Program Trees panel shows the expected PE sections

Saving Your Work

Ghidra does not auto-save your annotations. After making progress:

1. Press Ctrl+S to save the program database
2. When closing a project, Ghidra will ask if you want to save unsaved changes
3. For important analyses, use File > Save As to create backup copies

Common Pitfall: Losing hours of annotation work because you forgot to save. Build a habit of pressing Ctrl+S after every significant rename or comment addition.

Practical Exercise

1. Download a benign PE executable (e.g., notepad.exe from C:\Windows\System32) or a PMA Lab sample
2. Launch Ghidra and create a new Non-Shared Project named RE_Practice_01
3. Import the binary using File > Import File
4. Accept auto-analysis defaults and wait for analysis to complete
5. Verify: navigate the Symbol Tree, check Imports, browse the Listing and Decompile views
6. Locate the entry point by double-clicking entry in the Symbol Tree
7. Save the project with Ctrl+S